Snyk test report

Access Restriction Bypass

Overview

runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.

References

• Debian Bug Report
• Debian Security Tracker
• OSS security Advisory
• OSS security Advisory
• Ubuntu CVE Tracker

Out-of-bounds Write

Overview

Heap-based buffer overflow in the cpSeparateBufToContigBuf function in tiffcp.c in LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0beta7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7, 4.0.8 and 4.0.9 allows remote attackers to cause a denial of service (crash) or possibly have unspecified other impact via a crafted TIFF file.

References

• CVE Details
• DEBIAN
• Debian Security Tracker
• MISC
• MISC
• MLIST
• REDHAT
• REDHAT
• Ubuntu CVE Tracker
• Ubuntu Security Advisory
• Ubuntu Security Advisory

Integer Overflow or Wraparound

Overview

An issue was discovered in LibTIFF 4.0.9. There is a int32 overflow in multiply_ms in tools/ppm2tiff.c, which can cause a denial of service (crash) or possibly have unspecified other impact via a crafted image file.

References

• CVE Details
• DEBIAN
• Debian Security Announcement
• Debian Security Tracker
• MISC
• MISC
• REDHAT
• Ubuntu CVE Tracker
• Ubuntu Security Advisory
• Ubuntu Security Advisory

Out-of-bounds Write

Overview

tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a "Negative-size-param" condition.

References

• Bugtraq Mailing List
• DEBIAN
• Debian Security Advisory
• Debian Security Announcement
• Debian Security Tracker
• FEDORA
• FEDORA
• GENTOO
• GitHub Commit
• MISC
• MISC
• MLIST
• Ubuntu CVE Tracker

Incorrect Privilege Assignment

Overview

It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the UID/GID will be recycled.

References

• Debian Security Tracker
• Fedora Security Update
• Netapp Security Advisory
• RedHat Bugzilla Bug
• Security Focus
• UBUNTU
• Ubuntu CVE Tracker

Privilege Chaining

Overview

It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled.

References

• Debian Security Tracker
• Netapp Security Advisory
• RedHat Bugzilla Bug
• Security Focus
• UBUNTU
• Ubuntu CVE Tracker

Use After Free

Overview

A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.

References

• Debian Security Tracker
• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub Commit
• OSS security Advisory
• RedHat Bugzilla Bug
• Ubuntu CVE Tracker

NULL Pointer Dereference

Overview

In SQLite through 3.22.0, databases whose schema is corrupted using a CREATE TABLE AS statement could cause a NULL pointer dereference, related to build.c and prepare.c.

References

• CVE Details
• Debian Security Announcement
• Debian Security Tracker
• FEDORA
• MISC
• MISC
• MISC
• MISC
• MLIST
• OpenSuse Security Announcement
• Security Focus
• UBUNTU
• UBUNTU
• Ubuntu CVE Tracker

Integer Overflow or Wraparound

Overview

SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases), aka Magellan.

References

• Apple Security Advisory
• Apple Security Advisory
• Apple Security Advisory
• Apple Security Advisory
• Apple Security Advisory
• Apple Security Advisory
• CONFIRM
• CVE Details
• Chromium Issue
• Debian Security Announcement
• Debian Security Tracker
• FREEBSD
• Fedora Security Update
• Gentoo Security Advisory
• MISC
• MISC
• MISC
• MISC
• MISC
• MISC
• MISC
• MISC
• MISC
• MISC
• MISC
• MLIST
• N/A
• OpenSuse Security Announcement
• OpenSuse Security Announcement
• RedHat Bugzilla Bug
• RedHat Bugzilla Bug
• Security Focus
• Ubuntu CVE Tracker
• Ubuntu Security Advisory
• Ubuntu Security Advisory

NULL Pointer Dereference

Overview

In SQLite 3.27.2, interleaving reads and writes in a single transaction with an fts5 virtual table will lead to a NULL Pointer Dereference in fts5ChunkIterate in sqlite3.c. This is related to ext/fts5/fts5_hash.c and ext/fts5/fts5_index.c.

References

• Debian Security Tracker
• Fedora Security Update
• Fedora Security Update
• GENTOO
• MISC
• MISC
• MISC
• MISC
• MISC
• MLIST
• Netapp Security Advisory
• OpenSuse Security Announcement
• Security Focus
• UBUNTU
• Ubuntu CVE Tracker

Out-of-bounds Read

Overview

In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c, which may lead to an information leak. This is related to ext/fts5/fts5_hash.c.

References

• Debian Security Tracker
• Fedora Security Update
• Fedora Security Update
• GENTOO
• MISC
• MISC
• MISC
• MISC
• MISC
• MLIST
• Netapp Security Advisory
• OpenSuse Security Announcement
• Security Focus
• UBUNTU
• Ubuntu CVE Tracker

Integer Overflow or Wraparound

Overview

SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries in a "merge" operation that occurs after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases). This is a different vulnerability than CVE-2018-20346.

References

• Apple Security Advisory
• Apple Security Advisory
• Apple Security Advisory
• Apple Security Advisory
• Apple Security Advisory
• Apple Security Advisory
• Bugtraq Mailing List
• Bugtraq Mailing List
• Bugtraq Mailing List
• Bugtraq Mailing List
• Bugtraq Mailing List
• Bugtraq Mailing List
• Debian Security Tracker
• MISC
• MLIST
• N/A
• Netapp Security Advisory
• OpenSuse Security Announcement
• Seclists Full Disclosure
• Seclists Full Disclosure
• Seclists Full Disclosure
• Seclists Full Disclosure
• Seclists Full Disclosure
• Seclists Full Disclosure
• Security Focus
• Ubuntu CVE Tracker
• Ubuntu Security Advisory
• Ubuntu Security Advisory

Out-of-bounds Write

Overview

Integer overflow in SQLite via WebSQL in Google Chrome prior to 74.0.3729.131 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

References

• BUGTRAQ
• Chromium Issue
• DEBIAN
• Debian Security Tracker
• Fedora Security Update
• Fedora Security Update
• GENTOO
• MISC
• MLIST
• OpenSuse Security Announcement
• UBUNTU
• Ubuntu CVE Tracker

Improper Handling of Exceptional Conditions

Overview

selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error.

References

• Debian Security Tracker
• GENTOO
• GitHub Commit
• MLIST
• MLIST
• N/A
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Improper Initialization

Overview

SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled.

References

• Debian Security Tracker
• FREEBSD
• GENTOO
• MISC
• MISC
• MISC
• MISC
• MISC
• MLIST
• MLIST
• Netapp Security Advisory
• UBUNTU

Use After Free

Overview

Affected versions of this package are vulnerable to Use After Free ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.

Remediation

Upgrade sqlite3 to version or higher.

References

• ADVISORY
• CONFIRM
• CONFIRM
• CONFIRM
• CONFIRM
• CONFIRM
• CONFIRM
• CONFIRM
• Debian Security Tracker
• FEDORA
• FREEBSD
• FULLDISC
• FULLDISC
• FULLDISC
• FULLDISC
• GENTOO
• MISC
• MISC
• MISC
• MISC
• MLIST
• UBUNTU

Out-of-bounds Read

Overview

Affected versions of this package are vulnerable to Out-of-bounds Read. An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for Windows 7.19. A malicious application may cause a denial of service or potentially disclose memory contents.

Remediation

There is no fixed version for sqlite3.

References

• ADVISORY
• Debian Security Tracker
• MISC
• MISC
• MISC
• MISC
• MISC
• MISC
• MISC
• MLIST

Use After Free

Overview

Affected versions of this package are vulnerable to Use After Free. SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.

Remediation

Upgrade sqlite3 to version or higher.

References

• ADVISORY
• CONFIRM
• FEDORA
• GENTOO
• MISC
• MISC
• MISC
• MISC
• MLIST

Improper Encoding or Escaping of Output

Overview

Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request.

Remediation

Upgrade python3.5 to version or higher.

References

• ADVISORY
• CONFIRM
• FEDORA
• FEDORA
• FEDORA
• FEDORA
• FEDORA
• GENTOO
• MISC
• MISC
• MLIST
• SUSE
• UBUNTU

Integer Overflow or Wraparound

Overview

Modules/_pickle.c in Python before 3.7.1 has an integer overflow via a large LONG_BINPUT value that is mishandled during a "resize to twice the size" attempt. This issue might cause memory exhaustion, but is only relevant if the pickle format is used for serializing tens or hundreds of gigabytes of data. This issue is fixed in: v3.4.10, v3.4.10rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.7rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.7, v3.6.7rc1, v3.6.7rc2, v3.6.8, v3.6.8rc1, v3.6.9, v3.6.9rc1; v3.7.1, v3.7.1rc1, v3.7.1rc2, v3.7.2, v3.7.2rc1, v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

References

• CVE Details
• Debian Security Announcement
• Debian Security Tracker
• Fedora Security Update
• Fedora Security Update
• Fedora Security Update
• Fedora Security Update
• Fedora Security Update
• Fedora Security Update
• GitHub Commit
• MISC
• MLIST
• Netapp Security Advisory
• REDHAT
• SUSE
• UBUNTU
• UBUNTU
• Ubuntu CVE Tracker

NULL Pointer Dereference

Overview

An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.

References

• ADVISORY
• Debian Security Tracker
• GENTOO
• MLIST
• MLIST
• MLIST
• RHSA Security Advisory
• RHSA Security Advisory
• SUSE
• Talos Vulnerability Report
• Ubuntu CVE Tracker

Improper Input Validation

Overview

An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally.

References

• ADVISORY
• CONFIRM
• Debian Security Announcement
• Debian Security Announcement
• Debian Security Tracker
• FEDORA
• FEDORA
• FEDORA
• FEDORA
• FEDORA
• FEDORA
• FEDORA
• FEDORA
• FEDORA
• FEDORA
• FEDORA
• Fedora Security Update
• Fedora Security Update
• Fedora Security Update
• Fedora Security Update
• GitHub Commit
• MISC
• MISC
• MLIST
• MLIST
• MLIST
• N/A
• REDHAT
• REDHAT
• SUSE
• SUSE
• SUSE
• SUSE
• SUSE
• UBUNTU
• UBUNTU
• Ubuntu CVE Tracker

Improper Input Validation

Overview

Affected versions of this package are vulnerable to Improper Input Validation. In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.

Remediation

Upgrade python3.5 to version or higher.

References

• ADVISORY
• CONFIRM
• CONFIRM
• CONFIRM
• FEDORA
• FEDORA
• FEDORA
• FEDORA
• FEDORA
• FEDORA
• FEDORA
• FEDORA
• FEDORA
• FEDORA
• FEDORA
• FEDORA
• FEDORA
• FEDORA
• GENTOO
• MISC
• MLIST
• MLIST
• SUSE
• SUSE
• SUSE
• SUSE
• UBUNTU

NULL Pointer Dereference

Overview

An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.

References

• ADVISORY
• Debian Security Tracker
• GENTOO
• MLIST
• MLIST
• MLIST
• RHSA Security Advisory
• RHSA Security Advisory
• SUSE
• Talos Vulnerability Report
• Ubuntu CVE Tracker

Improper Input Validation

Overview

An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally.

References

• ADVISORY
• CONFIRM
• Debian Security Announcement
• Debian Security Announcement
• Debian Security Tracker
• FEDORA
• FEDORA
• FEDORA
• FEDORA
• FEDORA
• FEDORA
• FEDORA
• FEDORA
• FEDORA
• FEDORA
• FEDORA
• Fedora Security Update
• Fedora Security Update
• Fedora Security Update
• Fedora Security Update
• GitHub Commit
• MISC
• MISC
• MLIST
• MLIST
• MLIST
• N/A
• REDHAT
• REDHAT
• SUSE
• SUSE
• SUSE
• SUSE
• SUSE
• UBUNTU
• UBUNTU
• Ubuntu CVE Tracker

Improper Input Validation

Overview

Affected versions of this package are vulnerable to Improper Input Validation. In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.

Remediation

Upgrade python2.7 to version or higher.

References

• ADVISORY
• CONFIRM
• CONFIRM
• CONFIRM
• FEDORA
• FEDORA
• FEDORA
• FEDORA
• FEDORA
• FEDORA
• FEDORA
• FEDORA
• FEDORA
• FEDORA
• FEDORA
• FEDORA
• FEDORA
• FEDORA
• GENTOO
• MISC
• MLIST
• MLIST
• SUSE
• SUSE
• SUSE
• SUSE
• UBUNTU

Use of a Broken or Risky Cryptographic Algorithm

Overview

Affected versions of this package are vulnerable to Use of a Broken or Risky Cryptographic Algorithm. A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-the-middle attack, or the ability to observe clear-text transmissions, could exist. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Remediation

Upgrade postgresql-9.6 to version or higher.

References

• ADVISORY
• CONFIRM
• GENTOO
• MISC
• MISC
• MLIST

SQL Injection

Overview

Affected versions of this package are vulnerable to SQL Injection. A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Remediation

Upgrade postgresql-9.6 to version or higher.

References

• ADVISORY
• CONFIRM
• GENTOO
• MISC
• MISC
• MLIST

Insufficient Comparison

Overview

Affected versions of this package are vulnerable to Insufficient Comparison. A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \gset when querying a compromised server, the attacker can execute arbitrary code as the operating system account running psql. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Remediation

Upgrade postgresql-9.6 to version or higher.

References

• ADVISORY
• GENTOO
• MISC
• MISC
• MLIST

Untrusted Search Path

Overview

Affected versions of this package are vulnerable to Untrusted Search Path. It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script, during the installation or update of such extension. This affects PostgreSQL versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23.

Remediation

Upgrade postgresql-9.6 to version or higher.

References

• ADVISORY
• CONFIRM
• DEBIAN
• GENTOO
• MISC
• SUSE
• SUSE
• SUSE
• SUSE
• SUSE
• SUSE
• UBUNTU

Integer Overflow or Wraparound

Overview

Affected versions of this package are vulnerable to Integer Overflow or Wraparound. Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.

Remediation

Upgrade perl to version or higher.

References

• CONFIRM
• CONFIRM
• CONFIRM
• CONFIRM
• CONFIRM
• Debian Security Tracker
• FEDORA
• GENTOO
• MISC
• MISC
• SUSE
• Ubuntu CVE Tracker

Buffer Overflow

Overview

Affected versions of this package are vulnerable to Buffer Overflow regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.

Remediation

Upgrade perl to version or higher.

References

• CONFIRM
• CONFIRM
• CONFIRM
• CONFIRM
• Debian Security Tracker
• FEDORA
• GENTOO
• MISC
• MISC
• MISC
• MISC
• SUSE
• Ubuntu CVE Tracker

Out-of-bounds Write

Overview

Affected versions of this package are vulnerable to Out-of-bounds Write. Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.

Remediation

Upgrade perl to version or higher.

References

• CONFIRM
• CONFIRM
• CONFIRM
• CONFIRM
• Debian Security Tracker
• FEDORA
• GENTOO
• MISC
• MISC
• SUSE
• Ubuntu CVE Tracker

Integer Overflow or Wraparound

Overview

Affected versions of this package are vulnerable to Integer Overflow or Wraparound. An issue was discovered in p11-kit 0.21.1 through 0.23.21. Multiple integer overflows have been discovered in the array allocations in the p11-kit library and the p11-kit list command, where overflow checks are missing before calling realloc or calloc.

Remediation

Upgrade p11-kit to version or higher.

References

• ADVISORY
• DEBIAN
• MISC
• MISC
• MLIST

Integer Overflow or Wraparound

Overview

Affected versions of this package are vulnerable to Integer Overflow or Wraparound. The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).

Remediation

Upgrade openssl1.0 to version or higher.

References

• ADVISORY
• CONFIRM
• CONFIRM
• CONFIRM
• CONFIRM
• CONFIRM
• CONFIRM
• CONFIRM
• DEBIAN

Integer Overflow or Wraparound

Overview

Affected versions of this package are vulnerable to Integer Overflow or Wraparound. Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).

Remediation

Upgrade openssl1.0 to version or higher.

References

• ADVISORY
• CONFIRM
• CONFIRM
• CONFIRM
• CONFIRM
• CONFIRM
• DEBIAN

Integer Overflow or Wraparound

Overview

Affected versions of this package are vulnerable to Integer Overflow or Wraparound. Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).

Remediation

Upgrade openssl to version or higher.

References

• ADVISORY
• CONFIRM
• CONFIRM
• CONFIRM
• CONFIRM
• CONFIRM
• DEBIAN

Integer Overflow or Wraparound

Overview

Affected versions of this package are vulnerable to Integer Overflow or Wraparound. The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).

Remediation

Upgrade openssl to version or higher.

References

• ADVISORY
• CONFIRM
• CONFIRM
• CONFIRM
• CONFIRM
• CONFIRM
• CONFIRM
• CONFIRM
• DEBIAN

NULL Pointer Dereference

Overview

Affected versions of this package are vulnerable to NULL Pointer Dereference. A NULL pointer dereference was found in OpenLDAP server and was fixed in openldap 2.4.55, during a request for renaming RDNs. An unauthenticated attacker could remotely crash the slapd process by sending a specially crafted request, causing a Denial of Service.

Remediation

Upgrade openldap to version or higher.

References

• ADVISORY
• CONFIRM
• CONFIRM

Integer Underflow

Overview

Affected versions of this package are vulnerable to Integer Underflow. An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in the Certificate Exact Assertion processing, resulting in denial of service (schema_init.c serialNumberAndIssuerCheck).

Remediation

Upgrade openldap to version or higher.

References

• ADVISORY
• CONFIRM
• DEBIAN
• MISC
• MISC
• MISC
• MISC
• MISC
• MLIST

Reachable Assertion

Overview

Affected versions of this package are vulnerable to Reachable Assertion. A flaw was discovered in OpenLDAP before 2.4.57 leading to an assertion failure in slapd in the saslAuthzTo validation, resulting in denial of service.

Remediation

Upgrade openldap to version or higher.

References

• ADVISORY
• CONFIRM
• DEBIAN
• MISC
• MISC
• MISC
• MISC
• MISC
• MISC
• MLIST

Double Free

Overview

Affected versions of this package are vulnerable to Double Free. A flaw was discovered in OpenLDAP before 2.4.57 leading to a double free and slapd crash in the saslAuthzTo processing, resulting in denial of service.

Remediation

Upgrade openldap to version or higher.

References

• ADVISORY
• CONFIRM
• DEBIAN
• MISC
• MISC
• MISC
• MISC
• MISC
• MISC
• MLIST

Out-of-bounds Read

Overview

Affected versions of this package are vulnerable to Out-of-bounds Read. A flaw was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Values Return Filter control handling, resulting in denial of service (double free and out-of-bounds read).

Remediation

Upgrade openldap to version or higher.

References

• ADVISORY
• CONFIRM
• DEBIAN
• MISC
• MISC
• MISC
• MLIST

Release of Invalid Pointer or Reference

Overview

Affected versions of this package are vulnerable to Release of Invalid Pointer or Reference. A flaw was discovered in OpenLDAP before 2.4.57 leading to an invalid pointer free and slapd crash in the saslAuthzTo processing, resulting in denial of service.

Remediation

Upgrade openldap to version or higher.

References

• ADVISORY
• CONFIRM
• DEBIAN
• MISC
• MISC
• MISC
• MISC
• MISC
• MISC
• MLIST

CVE-2020-36226

Overview

Affected versions of this package are vulnerable to CVE-2020-36226. A flaw was discovered in OpenLDAP before 2.4.57 leading to a memch->bv_len miscalculation and slapd crash in the saslAuthzTo processing, resulting in denial of service.

Remediation

Upgrade openldap to version or higher.

References

• ADVISORY
• CONFIRM
• DEBIAN
• MISC
• MISC
• MISC
• MISC
• MISC
• MISC
• MLIST

Loop with Unreachable Exit Condition ('Infinite Loop')

Overview

Affected versions of this package are vulnerable to Loop with Unreachable Exit Condition ('Infinite Loop'). A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancel_extop Cancel operation, resulting in denial of service.

Remediation

Upgrade openldap to version or higher.

References

• ADVISORY
• CONFIRM
• DEBIAN
• MISC
• MISC
• MISC
• MLIST

Integer Underflow

Overview

Affected versions of this package are vulnerable to Integer Underflow. An integer underflow was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Certificate List Exact Assertion processing, resulting in denial of service.

Remediation

Upgrade openldap to version or higher.

References

• ADVISORY
• CONFIRM
• DEBIAN
• MISC
• MISC
• MISC
• MLIST

Reachable Assertion

Overview

Affected versions of this package are vulnerable to Reachable Assertion. A flaw was discovered in OpenLDAP before 2.4.57 leading in an assertion failure in slapd in the X.509 DN parsing in decode.c ber_next_element, resulting in denial of service.

Remediation

Upgrade openldap to version or higher.

References

• ADVISORY
• CONFIRM
• DEBIAN
• MISC
• MISC
• MISC
• MLIST

Access of Resource Using Incompatible Type ('Type Confusion')

Overview

Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type ('Type Confusion'). A flaw was discovered in ldap_X509dn2bv in OpenLDAP before 2.4.57 leading to a slapd crash in the X.509 DN parsing in ad_keystring, resulting in denial of service.

Remediation

Upgrade openldap to version or higher.

References

• ADVISORY
• CONFIRM
• DEBIAN
• MISC
• MISC
• MISC
• MLIST

Reachable Assertion